Objective 2.13 Explain How to Verify That DNSSEC Is Working 302 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An admin is verifying DNSSEC on a BIG-IP DNS server that hosts a signed zone. They send a query from a test workstation to the BIG-IP's IP address directly. The response has the `qr` and `aa` flags set, but no RRSIG. What does this indicate?

   • AThe server is a recursive resolver and is returning a cached answer.
   • BThe server is not authoritative and is returning a referral.
   • CThe server is authoritative for the zone, but the zone is not signed or the DO bit was not set.
   • DThe zone is signed, but the signature was stripped by the network.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An admin is troubleshooting why DNSSEC validation fails for a zone hosted on BIG-IP DNS. They run `dig example.com A +dnssec` from a workstation and see the response has the `aa` flag set but no RRSIG for the A record. What does the presence of the `aa` flag tell them?

   • AThe server is a recursive resolver that has cached the zone.
   • BThe response came from a server that is authoritative for example.com.
   • CThe response was validated by a DNSSEC-validating resolver.
   • DThe zone is signed and the RRSIG was stripped by the network firewall.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An admin is verifying that DNSSEC is working on a BIG-IP DNS server. They run `dig example.com A +dnssec` and see an RRSIG in the answer section. What does the presence of the RRSIG confirm?

   • AThe zone's DNSKEY is published.
   • BThe server is authoritative for the zone.
   • CThe response was validated by a recursive resolver.
   • DThe zone is signed and the response includes the signature.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A BIG-IP DNS admin has a signed zone that was working. After a backup restore, the zone loads but returns no RRSIGs. The admin checks the zone directory and finds the `.sig` files are present. What is the most likely issue?

   • AThe DNS server is not authoritative for the zone.
   • BThe client is not sending the DO bit.
   • CThe `.sig` files are from a different zone or have incorrect permissions.
   • DThe zone was not signed before the backup.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An admin is verifying DNSSEC on a BIG-IP DNS server. They query the server for `example.com A` and receive a response with the AA bit set and an RRSIG. They want to confirm the response is from the authoritative server and not a cache. What flag should they check?

   • AThe RA (Recursion Available) flag.
   • BThe AD (Authentic Data) flag.
   • CThe AA (Authoritative Answer) flag.
   • DThe CD (Checking Disabled) flag.
   Reveal Solution Discussion Select an answer first